Intelligent vehicular occupant safety system

ABSTRACT

A vehicle occupant safety system involves multiple sensors within a vehicle, a monitor aggregator, a processor, a vehicle electronic control system, and a decision engine which will compare sensor data against a set of sensor parameters to determine whether any of multiple potential danger conditions exists within the vehicle, and determine which of multiple control actions are to be automatically taken and modify operation of at least one vehicle component. If a further determination is made that either the specified danger condition is persisting or has exceeded at least one specified severity threshold, the decision engine will determine whether to further modify operation of any vehicle component or take a specified escalation action. The decision engine will continue to make determinations regarding the specified danger condition and decide whether to take further control actions until the specified danger condition no longer exists.

FIELD OF THE INVENTION

This disclosure relates generally to vehicles and, more particularly, toprotection of vehicle occupants.

BACKGROUND

Temperatures in a parked car, even with the windows cracked, can heat upto over 120 degrees Fahrenheit within 15 minutes when the ambienttemperature outside is 80 degrees.

On average 37 children per year die from vehicular heatstroke in the US,mostly attributed to either being unintentionally or intentionally leftin the vehicle by an adult, or playing in unattended vehicle. Childrenare not the only ones at risk from being left in vehicles, Older adultsand persons with chronic medical conditions are particular susceptibleto extreme temperatures both heat related illnesses (heat cramps, heatexhaustion, heat syncope, or heatstroke) as well as hyperthermia. Heatrelated deaths and injuries to pets are also major issues, and whilethere is no formal tracking for pet heat-related deaths from being leftin vehicles, it clearly happens too often.

While temperature related deaths are a major issues it is not the onlyrisk when children, adults or pets are left in unattended vehicles,carbon monoxide poisoning also claims hundreds of lives a year frompeople sitting in running cars with faulty exhaust systems or in closedin spaces.

More recently, alarms have become available that notify a person,typically the vehicle owner, when someone has been left in a parkedvehicle. However, such notifications are often ineffective because thatperson typically already knows that fact and, thus, may ignore anynotification(s) to that effect.

Thus, there is an ongoing technological problem with protecting vehicleoccupants that may be incapable of doing so themselves.

SUMMARY

One aspect of this disclosure involves a vehicle occupant safety systemhaving multiple sensors within a vehicle; a monitor aggregator coupledto the multiple sensors; a processor coupled to the monitor aggregator;a vehicle electronic control system coupled to the processor and vehiclecomponent controls; a decision engine which, when executed by theprocessor, will i) compare sensor data, received by the processor fromthe multiple sensors via the monitor aggregator, against a set of sensorparameters to determine whether any of multiple potential dangerconditions exists within the vehicle, and ii) determine which ofmultiple control actions are to be automatically taken, via the vehicleelectronic control system, when some danger condition is determined toexist within the vehicle. When a specified danger condition exists, andbased upon the sensor data, the processor will cause the vehiclecomponent controls to modify operation of at least one vehicle componentcoupled to the vehicle component controls. If a further determination ismade by the decision engine, based upon further sensor data, that eitherthe specified danger condition is persisting for longer than a specifiedperiod of time, or has exceeded at least one specified severitythreshold, the decision engine will determine whether to further modifyoperation of any vehicle component or take a specified escalationaction, and the decision engine will continue to make determinationsregarding the specified danger condition and decide whether to takefurther control actions, via the vehicle electronic control system, ortake further specified escalation actions, until the specified dangercondition no longer exists.

The foregoing and following outlines rather generally the features andtechnical advantages of one or more embodiments of this disclosure inorder that the following detailed description may be better understood.Additional features and advantages of this disclosure will be describedhereinafter, which may form the subject of the claims of thisapplication.

BRIEF DESCRIPTION OF THE DRAWINGS

This disclosure is further described in the detailed description thatfollows, with reference to the drawings, in which:

FIG. 1 illustrates, in simplified form, one example representation of avehicle incorporating an occupant safety system as described herein;

FIG. 2 illustrates, in simplified form, a partial representation of aninterior of the vehicle of FIG. 1; and

FIG. 3 illustrates, in simplified form, a flowchart for onerepresentative example of a method performed by an example vehicleoccupant safety system configured as described herein.

DETAILED DESCRIPTION

This disclosure provides a technical solution to address theaforementioned problems. Our technical solution improves upon currentapproaches, for example, those that seek to protect occupant(s),typically children, left alone in a car, that deal with a singleissue—temperature—in a “one size fits all” approach.

Our system uses a decisional approach that takes advantage of sensorsthat are already present in a vehicle, as well as allowing foradditional sensors from third parties to be added, to make decisionsbased upon the sensor input to address danger conditions and, moreimportantly, in an advance over the current art, when a dangerouscondition exists, our system does not merely react, it continues tomonitor the situation via the sensors to determine if a danger conditionpersists or has changed and can take further control and/or escalationaction(s), if warranted, as a result.

FIG. 1 illustrates, in simplified form, one example representation of avehicle 100 incorporating an occupant safety system 102 as describedherein.

The occupant safety system 102 includes multiple sensors 104 within thevehicle 100 (only some of which are shown). Depending upon theparticular implementation, the sensors 104 may be integrated as part ofthe vehicle, or they may be third-party sensors that can be added later,for example. sensors that are constructed, for example, to communicateaccording to the Universal Plug and Play (UPnP) standard set forth inthe international standard adopted by the ISO and InternationalElectrotechnical Commission, Standard ISO/IEC 29341.

The occupant safety system 102 further includes a monitor aggregator 106that is coupled to the sensors 104 and converts the sensor outputs intoa common form and format.

The occupant safety system 102 also includes at least one processor 108coupled to the monitor aggregator 106 so that it can receive theconverted data from the sensors 104 and use that data as described ingreater detail herein.

The (at least one) processor 108 is also coupled to the vehicle'selectronic control system 110 that allows the vehicle to operate thevehicle component controls 112, for example, the controls for turningon/off the ignition, raising/lowering the windows, opening/closing asunroof/moon roof, turning on/off the air conditioning/heating system,and/or any autonomous vehicle functions, if present, like automaticparking and/or adaptive cruise control. In short, the vehicle componentcontrols 112 are any controls in the vehicle that can be used toautomatically manipulate (e.g., turn on/off, raise/lower, open/shut,start/stop, adjust, etc.) any component(s) of the vehicle or cause avehicle component (e.g., a cellular phone) to take some specifiedaction(s).

The system further includes storage 114, accessible to the processor108, that stores format defining data structures, data-containingstructures, and program instructions, in a non-transitory manner, forexample, such as non-transient solid state memory, a magnetic harddrive, a CD or DVD, a tape drive, or an analogous or equivalent storagemedium type would. Programming stored within the storage 114 that can beexecuted by the processor 108 implements a decision engine 116 that usesthe data from the sensors 104 to make decisions regarding the presenceof occupants, conditions within the vehicle, occupant condition andpotentially dangerous circumstances, in order to identify when a dangercondition exists within the vehicle 100 and can take actions to causecertain control and/or escalation actions to be undertaken, as describedherein, based upon that information.

FIG. 2 illustrates, in simplified form, a partial representation of aninterior 200 of the vehicle 100 of FIG. 1.

As shown in FIG. 2, the vehicle 100 specifically includes, by way ofexample, various different types of sensors 104, for example, motionsensor(s) 202, sound sensor(s) 204, seat belt latch sensors 206, seatoccupancy (weight) sensors 208, interior temperature sensor(s) 210, aglobal positioning satellite (GPS) system sensor 212, door lock positionsensor(s) 214, and interfaces 216, 218 via which third-party sensor's,for example, heart rate monitor(s), infrared sensor(s), carbon monoxide(CO) or other harmful exhaust gas sensors, etc., can be coupled to themonitor aggregator 106.

In operation, the decision engine 116 will receive data from the sensors104 that it receives via the monitor aggregator 106 and compare thatdata, in aggregate, against various sensor parameters in order toidentify whether a potential danger condition exists within the vehicle100. Depending upon the particular sensor and what is being sensed, theparameters can be simple binary values, i.e., to represent whether aseat is occupied or not, or they could be indicative of, or actually, anumerical value, for example, parts per million (ppm) for gasses.Examples of such parameters would be, whether or not the engine isrunning, whether the vehicle is occupied, the interior temperaturelevel, exterior temperature, positions of windows, vents and/or doorlocks (upper/lower boundary), CO/exhaust gas level (in ppm), whetherthere is motion within the vehicle, whether the vehicle is moving, etc.Based upon that comparison, when a danger condition does exist, thedecision engine could determine which, if any, control action(s) to takeand, using the processor, cause the state/operation of one or morevehicle components to be modified via the vehicle component controls112.

Advantageously, as part of the process, the decision engine can beprogrammed to take into account local laws, to some extent, based uponGPS location. For example, in some states, it is against the law forchildren to ride in the front seat of a vehicle with back seats. In suchcases, for maximum safety, the decision engine can be programmed topresume that a lone front passenger seat occupant is an adult and a loneback seat occupant is a child if the GPS indicates that it is in a statethat has such laws.

In contrast to existing systems that are simply reactive and operate inan “if-then” manner, e.g., excessive temperature in an occupied vehicle,then open windows and/or send an alert, the instant vehicle safetysystem makes decisions based upon the sensor input, so that the samedanger condition (e.g., excessive interior temperature) could yielddifferent actions depending upon other factors, for example, how manypeople are in the vehicle, where they are seated, where the vehicle islocated, etc.

Thus, for example, if the vehicle is occupied in a seat other than thedriver's seat, and the temperature is beyond a heat thresholdtemperature, based upon the sensor data, the decision engine coulddetermine whether the proper control action(s) would be to open one ormore windows and/or the sunroof/moon roof or, based upon GPS sensorinformation indicating that the vehicle is in an area where it is notunsafe to open the windows, it will cause the vehicle component controls112 to lock the doors (if unlocked) and turn on the engine and the airconditioning. In contrast, under the same sensed circumstance, if thedriver's seat is also occupied (or the only occupied seat) it might takeno action or merely cause an indicator light to be lit in the vehicle.Likewise, if the driver's seat was occupied, but a motion sensoridentified no motion within a given window of time and/or heart ratemonitor sensor identified an excessively high or low heart rate, thedecision engine would open the windows, trigger the horn and flash theheadlights to attract attention.

In a similar vein, if the sensors indicated a high CO level in thevehicle the decision engine might take one action if the vehicle has novehicle occupants, a different action if the vehicle is occupied, andfurther differentiate those actions based upon the external temperature,whether the occupants are moving, and/or where they are seated.

Still further, and in contrast to existing approaches, a decision engine116 operating as described herein will continue receiving sensor dataeven after it has determined that a danger condition exists and hastaken some action. As a result, the decision engine 116 can determinethat the danger condition has—either or both: (i) persisted for longerthan some specified period of time (which may be different dependingupon the nature of the danger condition and/or its severity, (ii)exceeded a severity threshold associated with that particular dangercondition. If the decision engine 116 determines that either (i) or (ii)has occurred, the decision engine will determine whether to furthermodify operation of some vehicle component or take some specifiedescalation action. By way of example, the severity threshold couldinvolve some numerical value, for example crossing a second temperaturethreshold indicating a worsening temperature situation accompanied by afailure to detect motion when previously motion was detected, or itcould involve some other non-numerical circumstance that neverthelessrepresents a worsening danger, like a persistent elevated carbonmonoxide level even though the windows have been lowered and the fanturned on.

Such further operation or escalation action could include, in oneillustrative example, if a danger condition relating to interiortemperature has persisted for more than a certain period of time eventhough the air conditioning has been turned on, the decision engine 116might cause the vehicle component controls 112 to open the windows evenif it initially determined the windows should not be opened based uponGPS location information because the area was considered “unsafe” or, inthe case of a vehicle with autonomous driving capability, if infraredsensors determined that there was a cooler area that is open and aheadof or near the vehicle (perhaps in a different open parking space shadedby a building or one or more trees) the vehicle might be controlled tomove into the cooler area, or, in some cases, do both.

By way of another illustrative example, if a high carbon monoxide levelpersisted in the vehicle, despite opening the windows and turning on thefan, perhaps because the vehicle is in an enclosed space, the decisionengine 116 could cause the vehicle component controls 112 to shut offthe engine and concurrently do one or more of: sounding the horn (usingthe universally recognized “S-O-S” signal), repeatedly raising and/orlowering of the windows, triggering the vehicle's alarm system and/orflashing the vehicle's lights, so as to attract maximum attention.

After a danger condition has been identified, the decision engine 116will continue to monitor the situation and make determinations regardingthe danger condition and decide if further actions are to be taken viathe vehicle electronic control system, or if further escalation actionsspecified for the particular danger condition until the danger conditionno longer exists.

Moreover, the continued monitoring by the decision engine 116 allows foridentification of further danger conditions that me be a result of, oreven caused by, the reaction to the original danger condition, and canreact to mitigate the new situation. For example, the reaction to anexcessive temperature condition might be to turn on the engine and airconditioning, but that action could lead to drawing in excessive carbonmonoxide into the car. As a result, the continued monitoring will allowthe decision engine to continue to make determinations, based upon datafrom the sensors, that the air conditioning option is no longer viableand modify its action(s) or take entirely different action(s) to dealwith the combined excessive heat and elevated carbon monoxidecircumstances as a new danger condition.

Thus, advantageously, vehicle occupant safety systems constructed tooperate according to the teachings herein can not only identify andreact to a danger condition, they can take increasing escalation steps(which can include modifying existing steps then-being taken) if thedanger condition persists, changes or worsens. Likewise, once a dangercondition has caused the decision engine 116 to take such escalatedaction, variants of the decision engine 116 can gradually de-escalate asthe danger condition abates and re-escalate if the danger conditionresumes and/or a new danger condition occurs and continue to do so untilthe danger condition(s) no longer exist.

Independent of the foregoing, optionally, with some implementations, ifthe vehicle is equipped with an in-vehicle cellular phone system, whenany danger condition persists or an escalation action is taken,optionally, the vehicle component controls 112 might also automaticallysend a pre-recorded message to emergency services (a.k.a. 9-1-1) alongwith the GPS coordinates of the vehicle, and possibly some indication ofthe situation.

FIG. 3 illustrates, in simplified form, a flowchart 300 for onerepresentative example of a method performed by an example vehicleoccupant safety system configured as described herein. It is to be notedthat the steps described in the flowchart 300, will be performed by thedecision engine 116 implemented by non-transiently stored programmingthat is retrieved and executed by on one or more processors in thevehicle.

Typically the process will run both while the vehicle is running andwhen it is not running. However, to avoid running down the vehicle'sbattery, the vehicle occupant safety system may include its ownrechargeable battery, or it may be configured to “sleep” (i.e., go intoan extremely low power usage state) when certain conditions are met, forexample, the vehicle has been off for more than some significant periodof time, the sensor data has all been within some normal range duringthat time, and no vehicle occupants have been detected, and, thereafter,while in the “sleep” state, will periodically check for sensor dataindicating at least one occupant (e.g., human or animal) is in thevehicle, for example, based upon the motion and/or seat or other sensordata, at which point it will “wake” and begin monitoring.

The process thereafter begins with the decision engine 116 receivingsensor data via the monitor aggregator 106 (Step 302). The received datais then compared against parameter sets that are non-transiently storedin storage in the vehicle (Step 304) to determine if a danger conditioncurrently exists within the vehicle (Step 306). If the decision engine116 determines that a danger condition does currently exist, thedecision engine 116 will determine whether the existing danger conditionis new or ongoing (Step 308). If the danger condition is new, then,based upon the sensor data and parameters, the decision engine willmodify operation of one or more vehicle component(s), via the vehiclecomponent controls 112 (Step 314) in an attempt to alleviate the dangercondition. As shown in the flowchart 300, the decision engine 116 thenchecks whether any escalation action(s) should be taken (Step 316).However, depending upon the particular implementation, for this specificpath, since this danger condition is new, this check could be bypassed(shown by the dashed line) and the process would return to themonitoring loop (Step 302 through Step 306).

If the decision engine 116 determines in the monitoring loop (Step 302through Step 306) that a danger condition does not exist, the decisionengine 116 will determine whether this is a result of a prior dangercondition just ceasing (i.e., it no longer exists) (Step 320) or ifeverything continues to be normal. If everything has been normal, theanswer will be “No” and the process will return to the monitoring loop(Step 302 through Step 306).

If, at Step 308, the decision engine 116 determines that the dangercondition is not new (i.e., it has already previously been identifiedand persists), the determination engine 116 will determine whether thedanger condition has persisted for too long (i.e., for longer than somespecified period of time (which may be different for different dangerconditions)) and/or has exceeded any severity threshold(s) (Step 310).If neither is the case, the decision engine will continue to monitor thesituation by returning to the monitoring loop (Step 302 through Step306). If, however, the decision engine 116 determines in Step 310 thateither is true, the decision will determine whether the operation of anyvehicle components should be modified (Step 312) and, if so, it will doso (Step 314). Both, after passing through Step 312 or if the decisionengine determines that no vehicle components should be modified, thedecision engine will determine whether any escalation action(s) shouldbe taken (Step 316). If not, the process will again return to themonitoring loop (Step 302 through Step 306). If so, the decision enginewill take the appropriate escalation actions (based upon the particulardanger condition in effect and persistence and/or severity threshold(s)exceeded) (Step 318) and return to the monitoring loop (Step 302 throughStep 306).

At this point, it should be understood that, depending upon theparticular implementation of the system and process, the decision enginemay maintain certain data that will enable it to track one or moreconcurrent danger conditions, individually or in aggregate. Thus, when aparticular danger condition is first identified, it may be assigned anidentification number and then as the process progresses conditions(e.g., the sensor data) may be tracked and some or all may be retained,for example, to determine persistence, adverse or favorable changes overtime, or interrelated danger conditions (based upon an implied, orpossible, cause/effect relationship). Advantageously, by doing so, thedecision engine 116 can operate more effectively in taking theappropriate action(s) when a danger condition exists. Moreover, for agiven set of sensor data, it can take different actions depending uponthe “history” of that danger condition and/or any other current, orrecently ended danger conditions, thereby allowing it to recognize fromthe same current data conditions the difference between an isolateddanger condition and one that may have been triggered by a prior,alleviated condition. For example, by tracking the sensor informationthe decision engine will be able to differentiate between thecircumstance where an occupant may have gone to sleep in the vehicle andthen, over time, an over-temperature condition occurs from a situationwhere a persistent over-temperature condition has recently beenalleviated, but thereafter the occupant(s) suffer a medical emergency(e.g., pass out) due to the lasting effect of that prior danger on themand thus, are not merely “taking a nap” in the vehicle.

Returning to the flowchart 300, if, as part of the monitoring loop (Step302 through Step 306) it is determined that a danger condition does notcurrently exist (Step 306) but a danger condition has just ceased (Step320), the decision engine can act to potentially “undo” some/all of itsprior actions by again modifying operation of vehicle component(s) viathe vehicle component controls (Step 314) and then returning to themonitoring loop (Step 302 through Step 306), for example, via the dashedline path shown.

Thus, it should be recognized and understood that vehicle occupantsafety systems constructed and operating according to the teachingsherein are much more adaptable than current systems that operate in asimple “if/then” fashion (e.g., if temperature exceeds a threshold, thenopen the windows and honk the horn and if temperature goes down enoughbelow the threshold then reverse the process).

Having described and illustrated the principles of this application byreference to one or more example embodiments, it should be apparent thatthe embodiment(s) may be modified in arrangement and detail withoutdeparting from the principles disclosed herein and that it is intendedthat the application be construed as including all such modificationsand variations insofar as they come within the spirit and scope of thesubject matter disclosed.

What is claimed is:
 1. A vehicle occupant safety system comprising: a)multiple sensors within a vehicle, the multiple sensors including atleast one carbon monoxide (CO) sensor and GPS sensor in the vehicle; b)a monitor aggregator coupled to the multiple sensors; c) a processorcoupled to the monitor aggregator; d) a vehicle electronic controlsystem coupled to the processor and vehicle component controls; e) adecision engine which, when executed by the processor, will i) comparesensor data, received by the processor from the multiple sensors via themonitor aggregator, against a set of sensor parameters to determinewhether any of multiple potential danger conditions exists within thevehicle, and ii) determine which of multiple control actions are to beautomatically taken, via the vehicle electronic control system, whensome danger condition is determined to exist within the vehicle; f)wherein, when a specified danger condition relating to CO level alone,or in combination with vehicle interior temperature, exists, and basedupon the sensor data the processor will cause the vehicle componentcontrols to modify operation of at least one vehicle component coupledto the vehicle component controls, g) wherein, if a furtherdetermination is made by the decision engine, based upon further sensordata, that either the specified danger condition is persisting forlonger than a specified period of time, or has exceeded at least onespecified severity threshold, the decision engine will determine, usingGPS location information from the GPS sensor, whether or not the vehicleis in an unsafe location and whether the vehicle is occupied and whereany occupants are located, how to further modify operation of anyvehicle component or take any of at least two specified escalationactions available for the same specified danger condition; and h)wherein, the decision engine will continue to make determinationsregarding the specified danger condition and decide whether to takefurther control actions, via the vehicle electronic control system, ortake further specified escalation actions, until the specified dangercondition no longer exists.